fix(architecture): restore module and semantic owner guards

[songoow]

Goal And Delivered Outcome

Two architecture checks fail on unchanged main as well as the CI-fixture proposal: the top-level Python package contains 147 modules against its existing 146 limit, and removing a required TypeScript owner no longer trips the semantic coverage floor. The failed hosted module-budget case and owner-removal case remain failed evidence.

This restores those existing guards. The inert recovery filesystem adapter moves beside its existing typed audit owner, returning the top-level count to 146. The semantic owner floor and its independent anchor rise from 53 to the already registered 54 symbols, so removing either generated Turn owner is rejected again. No assertion is removed and the module ceiling is unchanged.

Author Declaration

Written by model_agent — Codex, OpenAI. Acceptance comes from monorepo-distribution-split-v0.md section 9, the pinned module-budget fixture, the existing semantic coverage anchor and the unchanged owner-removal counterexamples. Immutable implementation base: e0cfa33aed564dbc917cb1186568621bfd41cdb9.

Criterion	Result	Evidence
Preserve the 146-module package boundary	implemented	Same original budget test fails before the move and passes afterward; the actual added module was state_recovery.py, not the alphabetically last name printed by the guard.
Retain both required TypeScript owner slots	implemented	Existing turn_route and loop_disposition removal cases fail on base/head/current-main controls and pass after tightening the floor.
Preserve recovery behavior and readback	verified locally	Real CLI, HTTP, File/SQLite, corrupt-input, missing-source, no-activation and cleanup cases; independently installed wheel CLI/readback.

Scope And Continuation

The Python adapter now lives in loopx/control_plane/state_recovery_io.py; TypeScript remains the recovery admission/audit decision owner. Update all in-repository CLI, HTTP and test imports and the bilingual RFC source links. The internal Python import path changes; no documented external Python import contract or persisted module identity was found, so no obsolete top-level shim is added. Undiscovered external imports remain a review risk. CLI, HTTP, schemas, receipts, archive limits and inert/no-execution behavior are unchanged.

No frontend layout, Lark operation, new capability/provider/configuration or shared vocabulary is introduced. Existing recovery entrypoints retain their behavior. The related refactor co-locates the transport with its existing owner; no parallel Python policy or new package framework. The two commits separate the IO move/callers from semantic coverage metadata. Reverting either commit restores its prior owning boundary independently.

This is a companion dependency for #6416; that PR retains its original fixture/documentation scope. Its hosted failures are not waived. Maintainer review/adoption and current-head hosted qualification remain required; no merge or deployment is performed here.

Validation

Tested final source tree: c86f19cf6a9328273307830ae74e325452eec25f.

• Original three selected cases fail identically on event base 76cdb27d, author head 14cadd486 and current main e0cfa33a. Source blobs and the actual CI merge aaf1a2b2 were compared; these are shared failures, not CI scheduling effects.
• Before moving code: all 35 recovery cases passed, including actual CLI/HTTP and File/SQLite readback. After repair: 190 passed, zero failures/skips across package budget, generated Turn contracts, semantic drift and the same recovery suite. Another 29 import-boundary/package-ratchet tests passed.
• Full semantic smoke, the prior changed-source advisory (including the new module path), Ruff, whitespace and public-boundary scans passed. No vocabulary values or owner identities changed; coverage metadata was tightened. Counts alone do not prove semantic equivalence.
• Built and verified the existing Chat bundle, built a wheel, and installed it into an isolated environment outside the checkout. The wheel contains the moved adapter and typed worker, omits the retired module, and its actual backup-state verify --execute plus audit readback succeeds on synthetic data with execution_authority_granted=false, activation_eligible=false and an inert unregistered workspace.
• Python 3.11.7; Node 22.23.2 / SQLite 3.51.3. The first wheel attempt correctly refused missing frontend assets; source assets were prepared before rebuilding. An initial private launcher resolved the venv symlink to the base interpreter; the corrected installed provenance and successful command were read back.

The local checks used no active Goal, real credentials, paid model, benchmark, deployment, hosted rerun or PostgreSQL store mutation; the separate disposable hosted PostgreSQL qualification is recorded below. This does not qualify installed App interaction, PostgreSQL recovery or sustained Windows behavior. Current-head hosted checks and independent maintainer review remain pending.

Frontend / Visual Evidence

No UI changes. Existing source HTTP recovery journey, including corrupt-input rejection, and packaged frontend build were exercised; installed App/browser interaction is unqualified.

Boundary Checklist

• Existing typed audit/coverage owners reused; no new execution authority.
• Original module ceiling and negative assertions retained.
• Private state, raw logs, credentials and machine paths excluded.
• Every branch commit includes DCO sign-off.

Hosted PostgreSQL qualification

The natural PostgreSQL job passed against a disposable PostgreSQL 16.15 service. The live s2b.postgresql_conformance_live row records 349 TAP passes, zero failures/skips; the service-admission suite passes all 11 tests with zero failures/skips/cancellations.

Actual checkout: 1ad57309ec6c6657083ea2c2f9083a6a8757db35, event base 04b6e1b2a1338473672024f14c2141493e8deb33 plus authored head c86f19cf6a9328273307830ae74e325452eec25f. Every changed proposal path has the same blob in that checkout and the authored head. This qualifies the tested live-store/service boundary; it does not qualify PostgreSQL archive recovery, installed App interaction, sustained Windows behavior or the still-pending full PR checks and independent review. No hosted rerun was requested.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · xhigh

动机

维护者在提交与检查备份时，会遇到持续阻塞合并的结构检查失败，以及无法识别语义 owner 被删除的漏检。原来正常恢复备份也无法通过根模块数量检查，删除任一新增 TypeScript owner 又可能被误判为覆盖完整；修改后根模块回到既有上限，两个删除反例都会被拒绝，备份检查流程继续可用。本 PR 已修复这两个确定性架构缺口，并保留安装包中的备份检查、失败恢复和历史结果读取。本 PR 不关闭完整 Python 分片、长期并发与成本验收，也不改变发布优先级或激活任何恢复出的 Goal。

改动思路

恢复规则继续由既有 TypeScript owner 决定，Python 只搬迁同一份文件 IO；覆盖下限属于既有强制检查，不应另设可选策略。本 PR 的边界是两个架构缺口及其真实恢复调用链；根模块上限不放宽，公共 CLI、HTTP、持久化审计和前端交互不变。

真实调用顺序仍是 CLI 或现有配置备份 HTTP 入口 → Python 归档 IO → 既有 TypeScript 清单规则与离线 owner worker → 惰性副本及审计 → CLI/前端结果与历史读取。成功不会登记或激活 Goal；摘要不符则在 tar 解码前拒绝，复制途中失败仍清理 staging。没有新增能力、配置开关、状态源或自动执行权限。语义检查继续用已有 registry floor 与独立 anchor，修复的是少算一个 owner 的余量。

以本次 head 为准，两个缺口可直接比较：

触发	原来	本次
检查根 Python 模块数	147 超过已批准的 146	原 IO 搬到既有 owner 下，146 上限保留
单独删除任一新 TS owner	54 变 53，旧下限仍允许，原负例失败	下限与独立 anchor 同为 54，原负例成立
检查有效/损坏备份、重读审计	原有离线检查与拒绝语义	同一规则、同一数据格式和真实入口继续工作

这项有界整理已消除根目录的内部入口；保留无使用者的兼容壳会让数量缺口原样存在。仓内 active caller、公开参考文档和测试检索未找到已建立的外部 Python import 契约，故符合内部移动规则；仓外未公开消费者仍列为残余风险。

具体改动

审查 head：c86f19cf6a9328273307830ae74e325452eec25f。相对共同基线 e0cfa33aed564dbc917cb1186568621bfd41cdb9，共 9 个文件、重命名识别后 +16/-16；442 行 IO 实现只改相对 import 与 worker 定位。CLI、HTTP、七处测试 import 和双语 RFC 源码链接同时迁移。另三行把 registry、独立 smoke anchor 和固定断言从 53 同步到 54；原模块上限、原 owner 删除反例均未删改。

规范为 docs/architecture/rfcs/monorepo-distribution-split-v0.md，按变更前不可变版本 e0cfa33aed564dbc917cb1186568621bfd41cdb9 判断：

• Top-level module count never grows：implemented；保持原 146 上限，通过原失败用例及完整 budget family。
• I3：implemented；内部入口迁移全部活跃消费者并删除旧路径；未发现需要一版弃用桥的已建立公共 import。
• I2：implemented；TypeScript 状态/清单/worker 决策源保持原样，Python 仍只承担 IO，没有第二份权威规则。
• I6：implemented；没有 schema、许可、公开/私密边界变更，错误文案与容量边界逐字保持。

关键代码讲解

1. verify_state_backup，342 行：显式读取 archive/manifest，先经 typed owner 验摘要，再扫描归档。preview 不复制；execute 只发布惰性副本，审计回读后原子完成，失败清理路径未改。CLI 与 HTTP 的真实 File/SQLite 测试覆盖它。
2. _audit_owners，87 行：worker 改用当前安装模块的同级 state_recovery_worker.ts，其余 Node 参数、超时和错误路径不变。此处最容易出现源码可用而 wheel 找不到 worker 的退化，故额外验证普通 wheel 的实际 SQLite owner 读取。
3. check_coverage_floor，614 行：仍检查实际数量不得低于 floor，且 floor 必须等于独立 anchor。54 是当前实际注册值；不是删除负例、放宽预算或新增语义词表。原两项删除反例现在真正保护对应 TS owner。

对主干的风险

最强退化反例是搬迁后 wheel 路径错、源码测试却仍绿。本次独立执行采用普通 frontend build → wheel → 独立 venv/site-packages → -I CLI 与真实 HTTP/chat 后端，原项目/运行时/registry 源路径已移走，只用合成数据。有效 SQLite 备份保留一项待办且副本 inactive；损坏摘要明确拒绝、不创建目标、不改既有审计。Ego Lite 中实际完成现有设置入口的校验、错误后清除成功结果、历史审计重开；另查键盘 Tab、390px 无横向溢出及 reduced-motion。界面代码未变，没有新增用户步骤或首屏变更。

验证归属必须分清：这些独立执行首先在 d9a0e089c1323a58865b5fc56290b26d30a29df6 完成；后来发现社区 PR 已提交完全相同结果。已比较整个 Git tree，两者均为 7ceaec5f5dd2b9de2233b62daadf5166c0c6ed67，9 个变更 blob 全部一致；wheel 中 1,647 个 Python/TS/JSON 源文件也逐字一致，wheel SHA256 为 2f88d89f47053a383d69c59033ea08940ffead60699dd4b0a0ffc2fc3c6f97cd。因此执行结果可用于这个 exact head，commit 元数据、CQR 身份和审查结论不混同继承。未重复创建 PR，也没有改写社区作者分支。

基线原用例 47 passed / 3 failed；head 相关家族 76 passed，含全部原 50 个用例。另有完整语义与 import-boundary 家族 153 passed、触及 Python 的 Ruff、控制面 TypeScript typecheck、先 diff advisory 后完整 semantic smoke，以及风险 premerge 的 5 项 direct + 14 项 selected 全部执行通过。正常 wheel 的模块 import 在 PATH 为空、Node 不可发现时也成功，worker 文件存在；真正执行仍经过既有 Node 路径。

mypy 未通过，不把它记为绿色：相同两个 CLI/HTTP 入口、相同 Python 3.11.17/mypy/全部 51 个依赖版本和配置，基线与已验证 head 均为 4,814 errors / 566 files，完整 5,029 条 error+note 多重集逐字一致，SHA256 984b2ed67795218cc9dede022129c5b416084675eb4f0ca89c7be36e9cb6793e。移动的 IO 模块没有新增诊断；此既有全图债务有独立因果归属，不能用总数相同代替证明，也不能由本次评审宣告修好。

语义与 CI 对齐

本次复用既有词表和检查 owner；唯一刻意加强的是 53→54 下限。它是强制校验，diff inventory 则仍是 advisory。没有 substring 分类、领域特例、新协议状态或默认激活。原预算不改、两个删除反例不改，独立 oracle 仍在。遵循当前 wait_for_ci=false，本次未获取、轮询或等待 hosted CI；这里的 repository-required checks 指本地原生校验，不声称六分片已通过。

未验证或未由本 PR 解决的仍包括完整 hosted CI、长期并发/成本、全局桌面安装采用、PostgreSQL 与 Windows 恢复资格；没有因一次安装成功关闭这些验收。仓外未登记的旧 Python import 是兼容性残余风险。若 head、worker 打包、typed owner、相关 fixture 或依赖版本改变，应重新评估对应证据；同名命令或另一提交的绿色不能自动替代。

我的整体评价

在上述 exact head 上 APPROVE，限定为这两个架构缺口的完整修复。交付判断为 goal_achieved：已修复指定结构与语义防删除缺口，保持真实调用链可用。长期能力 preserved：副本仍 inert，审计可持久化后重读，原失败清理与未知存储处理保留，不改调度或任务承诺。用户体验 preserved：沿原入口完成检查、纠错及历史读取，无额外必填信息、确认或导航。

相关前瞻整理已实施为把同一份 IO 放回既有 owner，取消无消费者的根入口；更广的语言迁移没有当前必要。小改动不是批准理由，原反例修复、原规则保持、真实安装路径和失败/readback 才构成证据。这里不授予合并、发布、全局安装或 hosted 手动重跑权限，未解决的主项目验收继续由原拥有者推进。

English verdict: APPROVE — At c86f19cf6a9328273307830ae74e325452eec25f, both reproduced architecture defects are repaired without loosening the module budget or removing owner-deletion negatives. Independent real File/SQLite, CLI/HTTP, normal-wheel and packaged-frontend checks cover the relocated IO; full-tree equality explicitly binds execution reuse to this head. Existing mypy debt remains failed and baseline-equivalent. Full hosted CI and sustained-operation acceptance remain separate; this review grants no merge or release authority.